Rule ID
SV-288459r1287874_rule
Version
V1R1
CCIs
Sensitive DoW data could be exposed when an AI app processes device data in the cloud. SFR ID: FMT_SMF_EXT.1.1 #47
On the mobile device, try to browse unauthorized AI URLs. Examples to input: chatgpt.com, claude.ai, gemini.google.com, v0.dev. Verify the unauthorized AI websites cannot be reached. If the iPhone/iPad has not been configured to disable web-based AI interactions, this is a finding.
Configure the Apple iOS/iPadOS 27 device to disable web-based AI interactions. ***Method 1: 1. In the MDM server, navigate to the iOS/iPadOS Device Configuration Profiles. 2. Locate the Web Content filter payload. 3. Select the Blacklist (or "Never Allow" or Blocklist") option. 4. Enter specific domain names of AI websites to be blocked, e.g., chatgpt.com, claude.ai, gemini.google.com, v0.dev. 5. Deploy the profile to managed devices. This prevents Safari, Chrome, and third-party browsers from loading the listed URLs. ***Method 2: Chrome-Specific URL Policies If the site manages Chrome at the enterprise level, direct Chrome policies can be pushed to restrict browsing. 1. Navigate to the MDM server Web Content Filter settings. 2. Select Google Chrome for iOS. 3. Apply the URLBlocklist policy. 4. Enter the AI website domains in the policy payload to block them within the Chrome app exclusively.